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DETAILED ACTION 

Drawings 

1 . Figure 1 should be designated by a legend such as --Prior Art-- because only 
that which is old is illustrated. See MPEP § 608.02(g). Corrected drawings in 
compliance with 37 CFR 1 .121(d) are required in reply to the Office action to avoid 
abandonment of the application. The replacement sheet(s) should be labeled 
"Replacement Sheet" in the page header (as per 37 CFR 1 .84(c)) so as not to obstruct 
any portion of the drawing figures. If the changes are not accepted by the examiner, the 
applicant will be notified and informed of any required corrective action in the next Office 
action. The objection to the drawings will not be held in abeyance. 

Specification 

2. The disclosure is objected to because of the following informalities: Figure 5e is 
not listed in the list of drawings; and Figures 17d and 17e are listed in the list of 
drawings but no drawings are shown nor are they referenced further in the specification. 

Appropriate correction is required. 

Claim Objections 

3. Claims 54, 55, 56, 58 and 62 are objected to because of the following 
informalities as noted below. 

As to claim 54, line 14 states "said intermediate statistics". This appears refer to 
"said one or more intermediate statistics". If this is the case, please replace "said 
intermediate statistics" with - - said one or more intermediate statistics - - . 
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As to claim 55, line 2; claim 58, line 4; claim 62, line 4 and line 5-6, all refers 
to "said one or more of said intermediate statistics" which appears to mean "said one or 
more intermediate statistics". If this is the case, please replace "said one or more of 
said intermediate statistics" with - - said one or more intermediate statistics - - for each 
instance. 

As to claim 57, line 1-2 states "said intermediate statistics" which appears to 
mean "said one or more intermediate statistics". If this is the case, please replace said 
intermediate statistics" with - - said one or more intermediate statistics - -. 

This error is throughout all of the claims. Claim 54 initially refers to "one or more 
intermediate statistics". Please review all claims and make appropriate correction to 
have consistent antecedent basis throughout. 

Claim 56 also contains a misspelling of "organising" which should be 
"organizing". Please replace "organising" with - - organizing - - . This misspelling 
occurs throughout the specification. Please make appropriate corrections throughout. 

Claim Rejections - 35 USC § 101 

4. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

5. Claims 65, 66, 76, and 77 are rejected under 35 U.S.C. 101 because the 
claimed invention is directed to non-statutory subject matter. Each of the claims is 
directed to a "carrier". The specification defines carrier to include an optical or electrical 
signal which transitory signals ad is not a process, machine, manufacture, or 
composition of matter, and therefore, is not patentable. 
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6. Claim 67 is rejected under he claimed invention is directed to non-statutory 
subject matter because the disclosed invention is inoperative and therefore lacks utility. 
The claim is directed to a "database" which is simply a compilation of data and 
therefore, is not one of the enumerated categories of patentable subject matter of a 
process, machine manufacture, or composition of matter and therefore, is not 
patentable subject matter. 

Claim Rejections - 35 USC § 102 

7. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 1 02 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1 ) an application for patent, published under section 1 22(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

8. Claims 65-72, 77, 78, 80-83 and 87 are rejected under 35 U.S.C. 1 02(e) as 
being anticipated by Cranor et al. (US PGPub US 2003/0187977). 

As to claim 65, Cranor discloses a carrier carrying a code module to: 
"input query data for one or more queries, a query defining a statistic relating to 
one or more parameters of a digital mobile phone network communications session, to 
be determined from data captured from said phone network (network monitor allowing 
network application-level queries to collect statistics, U 14, 38-40, Fig. 2) ; and 

"format a said query to define said statistic in terms of one or more intermediate 
statistics relating to said one or more parameters and to be computed from said network 
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data, said statistic being computable from one or more sets of said one or more 
intermediate statistics" (an filtering, transformation, and aggregation (FTA) ("query") 
process may depend on the output of another FTA for input ("intermediate statistics"), U 
36; additionally, queries for monitoring tasks involving collection of aggregate statistics 
of the packet by combining several other intermediate statistics and aggregating them, U 
36, 40). 

As to claim 66, Cranor discloses a carrier with a code module to: 
"read one or more intermediate statistics for a query relating to one or more 
parameters of a digital mobile phone network communications session, said query 
defining a statistic to be determined from data captured from said phone network and 
computable from one or more sets of said one or more intermediate statistics; and 
determine said statistic from said one or more sets of said one or more intermediate 
statistics" (an filtering, transformation, and aggregation (FTA) ("query") process may 
depend on the output of another FTA for input ("intermediate statistics"), U 36; 
additionally, queries for monitoring tasks involving collection of aggregate statistics of 
the packet by combining several other intermediate statistics and aggregating them, U 
36, 40). 

As to claim 67, Cranor discloses a database with the code module of claim 66 
(a clearinghouse database stores output from FTAs (queries) which may be used as 
input to other FTAs ("intermediate statistics, If 33-36). 

As to claim 68, Cranor discloses: 
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"inputting network data captured from a digital mobile phone network, said 
network data comprising data for a plurality of communications sessions over said 
network, said network data including a plurality of session related parameters" (network 
monitor allowing network application-level queries to collect statistics, U 14, 38-40, Fig. 
2; queries can be applied to individual data packets or to streams of data for a particular 
TCP connection ("communication session)"); and 

"processing said divided data in accordance with one or more queries to 
generate statistical data for each of a plurality of said sessions, said query defining at 
least one statistic relating to one or more said parameters" (an filtering, transformation, 
and aggregation (FTA) ("query") process may depend on the output of another FTA for 
input ("intermediate statistics"), U 36); and 

"storing, in a data store, said statistical data for each of said sessions in 
association with a session identifier; whereby network data for a session used to 
generate said statistical data is retrievable" (a clearinghouse database stores output 
from FTAs (queries) which may be used as input to other FTAs ("intermediate statistics, 
II 33-36); it is inherent that the data is retrievable from the database). 

As to claim 69, Cranor discloses all of claim 68. 

Cranor further discloses "statistical data comprises statistical data aggregatable 
to provide said at least one statistic for a combination of two or more said sessions" 
(statistics are aggregatable and the groups for aggregation, i.e. session, can be 
specified, U 40). 

As to claim 70, Cranor discloses all of claim 68. 
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Cranor further discloses "operating on each said data structure to generate said 
statistical data" (data structures output by FTAs (queries) are called "tuples" which may 
be used as input to another FTA (query), If 14, 27). 

As to claim 71 , Cranor discloses all of claim 68. 

Cranor further discloses "storing indexed by one or more of said parameters" 
(data is stored by tuple (data structure) and stream id, If 14). 
As to claim 72, Cranor discloses all of claim 68. 

Cranor further discloses "processing is performed in parallel for said plurality of 
data structures"(processing FTAs are decomposed in multiple types that may be 
executed on a NIC, kernel space, or user space, Fig. 1, If 18). 

As to claim 77, Cranor discloses: 

"process captured network data in accordance with one or more queries to 
generate statistical data for each of a plurality of communications sessions in said 
network data, a said query defining at least one statistic relating to one or more of 
parameters of messages in said captured data(network monitor allowing network 
application-level queries to collect statistics, If 14, 38-40, Fig. 2; queries can be applied 
to individual data packets or to streams of data for a particular TCP connection 
("communication session"), If 30); and 

"store in a data store said statistical data for each of said sessions in association 
with a session identifier; whereby network data for a session used to generate said 
statistical data, is retrievable" (a clearinghouse database stores output from FTAs 
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(queries) which includes a stream id and tuple (data structure) which may be used as 
input to other FTAs ("intermediate statistics, Fig. 1, U 33-36). 
As to claim 78, Cranor discloses: 

"a plurality of data processors each configured to input network data for one of a 
plurality of concurrent communication sessions captured from a digital mobile phone 
network and to operate on said session data to generate statistical data" (multiple FTAs 
processed separately on tuples (data structures) to identify TCP ("communication") 
sessions on which FTAs (queries) can be performed, Fig. 1, H 27, 30-36); and 

"a database, coupled to said plurality of data processors, to store said statistical 
data for analysis" (data is stored in the clearinghouse database, Fig. 1, H 25, 27). 

As to claim 80, Cranor discloses all of claim 78 and further discloses "statistical 
data is generated by a query defining at least one statistic relating to one or more 
parameters associated with a said communications session" (query processes are used 
to filter, transform and aggregate of data captured during monitor of the network 
sessions, U 14). 

As to claim 81 , Cranor discloses all of claim 80 and further discloses "a query 
definition code module to send a said query to each of said data processors" (queries 
are formulated and FTAs are registered, U 30-36). 

As to claim 82, Cranor discloses all of claim 80 and further discloses "statistical 
data is aggregatable to provide said at least one statistic for a combination of two or 
more of said sessions" (monitoring data includes collection of aggregation statistics, U 
40). 
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As to claim 83, Cranor discloses all of claim 82 and further discloses "read said 
statistical data for a plurality of said sessions, to aggregate said read statistical data, 
and to provide said aggregated data for output" (monitoring data includes collection of 
aggregation statistics, Fig. 2., Tf 40-41, 67, and the clearinghouse database stores 
output of the FTA (query), Fig. 1 , U 33-36). 

As to claim 87, Cranor discloses all of claim 78 and further discloses "means to 
capture said network data from said communications network" (data arriving from the 
network is placed in a buffer, Fig. 7, 62). 

9. Claims 73, 76 and 89-97 are rejected under 35 U.S.C. 102(b) as being 
anticipated by Longworth et al. (US Patent No. 7,016,951) (hereinafter Longworth). 
As to claim 73, Longworth discloses: 

"means for inputting network data captured from a digital mobile phone network, 
said network data comprising data for a plurality of communications sessions over said 
network, said network data including a plurality of session related parameters" 
(observation port for a data stream containing communication sessions that is passed to 
an interpreter, Fig. 1, see Abstract); 

"means for dividing said captured network data into a plurality of data structures, 
one for each said communications session" (dividing a data stream into individual 
packets which are reconstructed into network sessions according to parameters, Fig. 1; 
see Abstract); 

"means for processing said divided data in accordance with one or more queries 
to generate statistical data for each of a plurality of said sessions, a said query defining 
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at least one statistic relating to one or more of said parameters" (backend interface 
allows interrogation of the data, Fig. 1; see Abstract); and 

"means for storing, in a data store, said statistical data for each of said sessions 
in association with a session identifier; whereby network data for a session used to 
generate said statistical data is retrievable" (session and summary database contain 
session information which can be accessed to make inquiries, Fig. 1, 5; col. 6, lines 
30-48 and col. 7, lines 40-43). 

As to claim 76, Longworth discloses: 

"input network data captured from a digital mobile phone network, said network 
data comprising data for a plurality of communications sessions over said network, said 
network data including a plurality of session related parameters" (observation port for a 
data stream containing communication sessions that is passed to an interpreter, Fig. 1, 
see Abstract); and 

"divide said captured network data into a plurality of data structures, one for each 
said communications session" (dividing a data stream into individual packets which are 
reconstructed into network sessions according to parameters, Fig. 1; see Abstract). 

As to claim 89, Longworth discloses a data splitter comprising: 

"an input to receive said captured network data" (Fig. 1, see Abstract); 

"a protocol stack decoder to decode a protocol stack of said captured network 
data and provide message data for said plurality of communication sessions" (Fig. 1, 
see Abstract, the parser module detects and identifies protocols, col. 6, lines 8-48); 
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"a data pipe, coupled to said protocol stack decoder, said data pipe being 
configured to store said message data in time order" (a network observation port 
collects a data stream in real time in order received and sends to an interpreter module, 
Fig. 1-2; col. 3, lines 29-36); 

"a session tracker to write session identification data into said pipe responsive to 
said message data" (the assembler module accepts incoming data packets and divides 
them into sessions, Fig. 1, col. 3, lines 52-59) ; and 

"a session exporter to read said message data and said session identification 
data and to export said message data to a session data file store selected according to 
said session identification data" (assembler module sends sessions to parser module 
which stores log of the sessions into session database files, Fig. 1, col. 4, lines 26-33). 

As to claim 90, Longworth discloses all of claim 89 and further discloses 
"session tracker is attached to said data pipe at a first position, and wherein said 
session exporter is attached to said data pipe at a second, later position" (Figs. 1-2 
show assembler module (session tracker) is earlier in the data flow and parser module 
(session exporter) which writes sessions to the session database is later in the data 
flow). 

As to claim 91, Longworth discloses: 

"a data capture device to capture data from an interface of the network" (Fig. 1, 
see Abstract); 
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"a data processor to process said captured data to generate statistical data 
relating to individual data communication sessions using said network" (Fig. 1, see 
Abstract); and 

"a report generator to input said statistical data and generate a said report" (Fig. 
1, see Abstract, col. 7, lines 11-39). 

As to claim 92, Longworth discloses all of claim 91 and further discloses " a data 
splitter to divide said captured network data into data for separate communication 
sessions for processing by said data processor" (Fig. 1, having an assembler module 
with a session file as described in col. 3, lines 52-59). 

As to claim 93, Longworth discloses all of claim 91 and further discloses 
"statistical data is generated by a query defining at least one statistic relating to one or 
more parameters associated with a said communications session" (backend 
presentation interface allows interrogation ("query")of the data, Fig. 1; see Abstract). 

As to claim 94, Longworth discloses all of claim 93 and further discloses 
"statistical data is aggregatable to provide said at least one statistic for a combination of 
two or more of said sessions" (the backend presentation interface allows queries 
against the database to collect statistics on sessions, Fig. 1, col. 7 , lines 44-67). 

As to claim 95, Longworth discloses all of claim 93 and further discloses "report 
is user definable" (presentation interface allows the user to define the report, col. 7, 
lines 32-38). 

As to claim 96, Longworth discloses all of claim 95 and further discloses "report 
comprises a marketing report" (on the backend, a system administrator may make 
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queries using a presentation interface regarding user activity, including, frequently 
visited websites, analysis of different network addresses and their most frequent 
communicants, col. 7, lines 11-19). 

As to claim 97, Longworth discloses all of claim 95 and further discloses "report 
comprises a user quality of service report" (the presentation interface allows user 
reports to be generated including general degree of user activity and other categories of 
characteristic data, col. 7, lines 11-31). 

Claim Rejections - 35 USC § 103 

1 0. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1 , 148 
USPQ 459 (1966), that are applied for establishing a background for determining 
obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 

1 1 . Claims 54-64, 74, 75, 79, 84-86 and 88 are rejected under 35 U.S.C. 1 03(a) as 
being unpatentable over Cranor et al. (US PGPub 2003/0187977) (hereinafter Cranor) 
in view of Longworth et al. (US Patent No. 7,016,051) (hereinafter Longworth). 

As to claim 54, Cranor discloses a method of: 
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"inputting network data captured from a digital mobile phone network" (data 
arriving in the network is placed in a buffer, Fig. 7, U 62, lines 3-5); 

"inputting query data for one or more queries, a query defining a statistic relating 
to one or more of said parameters, to be computed from said network data" (network 
monitor allowing network application-level queries to collect statistics, U 14, 38-40, Fig. 
2); 

"formatting a said query to define said statistic in terms of one or more 
intermediate statistics relating to said one or more parameters and to be computed from 
said network data, said statistic being computable from one or more sets of said one or 
more intermediate statistics" (an filtering, transformation, and aggregation (FTA) 
("query") process may depend on the output of another FTA for input ("intermediate 
statistics"), U 36; additionally, queries for monitoring tasks involving collection of 
aggregate statistics of the packet by combining several other intermediate statistics and 
aggregating them, U 36 40); 

"operating with said formatted query on said captured network data to determine 
said one or more intermediate statistics" (an application subscribes to an FTA process 
to receive statistics collected on the data, If 30-36); and 

"storing said intermediate statistics in a data store for analysis" (a clearinghouse 
database stores output from FTAs (queries) which may be used as input to other FTAs 
("intermediate statistics, U 33-36). 
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Cranor does not explicitly teach the capture network data comprises "a plurality 
of communications sessions over said network, said network data including a plurality of 
session related parameters". 

Longworth teaches the network data is captured and reassembled back into 
network sessions according to parameters (Fig. 1-2, Abstract). 

Longworth and Cranor are analogous art in that they both pertain to capturing 
and analyzing network data. It would have been obvious to one skilled in the art at the 
time the invention was made to capture network data relating to communication 
sessions as taught in Longworth with the network monitoring method in Cranor being 
that it allows statistics to be gathered for separate communication sessions, and is not 
constrained to detecting limited types of data, as indicated in the abstract of Longworth. 

As to claim 55, Cranor in view of Longworth disclose all of claim 54. 

Cantor further discloses "storing comprises storing said one or more of said 
intermediate statistics relating to said one or more parameters indexed by said one or 
more parameters" (a clearinghouse database stores output from FTAs (queries) which 
may be used as input to other FTAs ("intermediate statistics, U 33-36). 

As to claim 56, Cranor in view of Longworth disclose all of claim 54. 

Longworth further discloses "organising said captured network data by 
communications session prior to operating with said formatted query" (the reconstructed 
network sessions are stored and the backend interface can analyze the data for other 
purposes, see Fig.1, Abstract). 

As to claim 57, Cranor in view of Longworth discloses all of claim 56. 
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Longworth further discloses "storing comprises storing said intermediate statistics 
indexed by an identifier of a said communications session" (reconstructed network 
sessions are assembled according to parameters, such as, protocol type, source and 
destination addresses or ports, sequence number and other variables, all of which could 
be an identifier of the session, see Abstract; additionally, once type of session is 
determined, the session is stored in the database and assigned a unique storage 
address, col. 6, lines 30-34). 

As to claim 58, Cranor in view of Longworth discloses all of claim 56. 

Longworth further discloses "dividing said captured network data into a plurality 
of data structures, one for each said communications session" (data stream is 
assembled into reconstructed network sessions, see Abstract); and 

"operating with said formatted query comprises operating on each said data 
structure to determine said intermediate statistics" (at the backend, a presentation 
interface is available to perform SQL inquiries on the data, Fig. 1-2, col. 6, line 56 
through col. 7, line 31). 

As to claim 59, Cranor in view of Longworth discloses all of claim 58. 

Longworth further discloses "storing includes storing an identifier of a said data 
structure" (reconstructed network sessions are assembled according to parameters, 
such as, protocol type, source and destination addresses or ports, sequence number 
and other variables, all of which could be an identifier of the session, see Abstract; 
additionally, the IP addresses or port numbers may be used to identify a session, col. 4, 
lines 1-11). 



Application/Control Number: 10/587,462 Page 17 

Art Unit: 4124 

As to claim 60, Cranor in view of Longworth discloses all of claim 58. 

Cranor further discloses "providing captured network data for a communications 
session to a data pipe configured to store a time-ordered series of sets of entries, one 
for each of said one or more parameters, and reading parameters at a time position on 
said data pipe for a said formatted query" low-level FTAs are performed as the data 
comes in and results are fed to higher level FTAs fl| 15-17) and includes aggregating 
statistics based for time intervals fl[ 40); 

As to claim 61 , Cranor in view of Longworth discloses all of claim 54. 

Cranor further discloses "a database, the method further comprising determining 
a configuration for said database using said inputted query data" (the FTA (query) 
processes are started which create data schema that is registered with the 
clearinghouse database to create the database, U 32-36). 

As to claim 62, Cranor in view of Longworth discloses all of claim 54. 

Cranor further discloses "inputting selection data defining selected ones of said 
one or more parameters" (low level and high-level FTAs (queries) are performed; H 15- 
17); and 

"reading said intermediate statistics for said related parameters; and determining 
at least one said statistic for said related parameters from said intermediate statistics" 
(low-level FTAs (queries) can be used as input to a high-level FTA (query), (Fig. 7, U 
17, 62). 

As to claim 63, Cranor in view of Longworth discloses all of claim 62. 
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Longworth further discloses "selection data comprises marketing or customer 
service report data" (on the backend, a system administrator may make queries using a 
presentation interface regarding user activity, including, frequently visited websites, 
analysis of different network addresses and their most frequent communicants, col. 7, 
lines 11-19). 

As to claim 64, Cranor discloses a system comprising: 

"means for inputting network data captured from a digital mobile phone network" 
(data arriving in the network is placed in a buffer, Fig. 7, U 62, lines 3-5); 

"means for inputting query data for one or more queries, a query defining a 
statistic relating to one or more of said parameters, to be computed from said network 
data" (network monitor allowing network application-level queries to collect statistics, U 
14, 38-40, Fig. 2); 

"means for formatting a said query to define said statistic in terms of one or more 
intermediate statistics relating to said one or more parameters and to be computed from 
said network data, said statistic being computable from one or more sets of said one or 
more intermediate statistics" (an filtering, transformation, and aggregation (FTA) 
("query") process may depend on the output of another FTA for input ("intermediate 
statistics"), U 36; additionally, queries for monitoring tasks involving collection of 
aggregate statistics of the packet by combining several other intermediate statistics and 
aggregating them, U 36, 40); 
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"means for operating with said formatted query on said captured network data to 
determine said one or more intermediate statistics" (an application subscribes to an FTA 
process to receive statistics collected on the data, U 30-36); and 

"means for storing said intermediate statistics in a data store for analysis" (a 
clearinghouse database stores output from FTAs (queries) which may be used as input 
to other FTAs ("intermediate statistics, If 33-36). 

Cranor does not explicitly teach the capture network data comprises "a plurality 
of communications sessions over said network, said network data including a plurality of 
session related parameters". 

Longworth teaches network data is captured and reassembled back into network 
sessions according to parameters (Fig. 1-2, Abstract). 

As discussed above, Longworth and Cranor are analogous art in that they both 
pertain to capturing and analyzing network data. It would have been obvious to one 
skilled in the art at the time the invention was made to capture network data relating to 
communication sessions as taught in Longworth with the network monitoring method in 
Cranor being that it allows statistics to be gathered for separate communication 
sessions, and is not constrained to detecting limited types of data, as indicated in the 
abstract of Longworth. 

As to claim 74, Longworth discloses all of claim 73 but does not explicitly teach 
the further limitations of claim 74. 
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Cantor teaches "means for inputting query data defining said one or more 
queries" (network monitor allowing network application-level queries to collect statistics, 
U 14, 38-40, Fig. 2); 

"means for formatting a said query to define a said statistic in terms of one or 
more intermediate statistics relating to said one or more parameters and to be 
computed from said network data, said statistic being computable from one or more 
sets of said one or more intermediate statistics" (an filtering, transformation, and 
aggregation (FTA) ("query") process may depend on the output of another FTA for input 
("intermediate statistics"), If 36; additionally, queries for monitoring tasks involving 
collection of aggregate statistics of the packet by combining several other intermediate 
statistics and aggregating them, If 36, 40); 

"means for operating with said formatted query on said captured network data to 
determine said one or more intermediate statistics" (network monitor allowing network 
application-level queries to collect statistics, If 14, 38-40, Fig. 2); and 

"means for storing said intermediate statistics in said data store for analysis" (a 
clearinghouse database stores output from FTAs (queries) which may be used as input 
to other FTAs ("intermediate statistics"), If 33-36). 

Longworth and Cranor are analogous art in that they both pertain to capturing 
and analyzing network data. It would have been obvious to one skilled in the art at the 
time the invention was made to capture network data relating to communication 
sessions as taught in Longworth with the network monitoring method in Cranor being 
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that it allows statistics to be gathered for separate communication sessions, and is not 
constrained to detecting limited types of data, as indicated in the abstract of Longworth. 
As to claim 75, Longworth discloses all of claim 73. 

Longworth does not explicitly teach "a plurality of processors, each said data 
structure having an associated processor to perform said processing and to send said 
statistical data for a session over a network to said data store". 

Cranor discloses multiple FTAs processed separately on tuples (data structures) 
and the data is stored in the clearinghouse database, Fig. 1, H 27, 30-36). 

As previously discussed, Cranor and Longworth are analogous art. It would have 
been obvious to one skilled in the art at the time the invention was made to combine the 
processor structure in Cranor with the system in Longworth being that it allows higher 
throughput of the data monitoring and query processing. 

As to claim 79, Cranor discloses all of claim 78. 

Cranor does not explicitly teach "data processors has an associated file store 
configured to store data for a said communications session". 

Longworth discloses an assembler module that stores a session file for each 
session that is processed and later stored in the session database (Fig. 1). 

As previously discussed, Longworth and Cranor are analogous art. It would have 
been obvious to use the session file as taught in Longworth with the system in Cranor 
being that it allows the session information to be stored for later analysis. 

As to claim 84, Cranor in view of Longworth discloses all of claim 79. 
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Longworth further discloses "a splitter to input said captured network data, to 
divide said input data into data for separate communication sessions, and to write said 
split data into said communication session file stores" (the assembler module takes the 
data received for the network observation port and separates the data into sessions, 
Fig. 1, col. 7, lines 52-59). 

As to claim 85, Cranor in view of Longworth discloses all of claim 84. 

Longworth further discloses the "splitter further comprises a protocol stack 
decoder to decode a protocol stack of said communications network for dividing said 
captured data into communications sessions" (Fig. 1, see Abstract, the parser module 
detects and identifies protocols, col. 6, lines 8-48). 

As to claim 86, Cranor in view of Longworth discloses all of claim 84. 

Longworth further discloses: 

"a data pipe, said data pipe being configured to store time ordered message data 
representing parameters decoded from messages in said captured network data" (a 
network observation port collects a data stream in real time in order received and sends 
to an interpreter module, Fig. 1-2; col. 3, lines 29-36); 

"a session tracker, attached to said data pipe at a first position, to read said 
message data and write session identification data for said messages into said data 
pipe" (the assembler module accepts incoming data packets and divides them into 
sessions, Fig. 1, col. 3, lines 52-59); and 

"a session exporter, attached to said data pipe at a second, later position, to read 
said message data and said session identification data and to export said message data 
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to a session data file store selected according to said session identification data" 
(assembler module sends sessions to parser module which stores log of the sessions 
into session database files, Fig. 1, col. 4, lines 26-33). 
As to claim 88, Cranor discloses all of claim 78. 

Cranor does not explicitly teach "a report generator coupled to said database and 
configured to generate a report from said statistical data, said report including data 
aggregated over a plurality of said communications sessions". 

Longworth teaches a backend process for invoking inquiries on the data 
collected and recorded in the resulting databases and creating report via a presentation 
interface (col. 7, lines 11-39). 

As previously discussed, Longworth and Cranor are analogous art. It would have 
been obvious to one skilled in the art at the time the invention was made to combine the 
report generator in Longworth with the data collection in Cranor being that it allows 
more ways to present the information that are meaningful to a system administrator 
viewing the information. 

Conclusion 

12. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

• Moore et al. (US PGPub 2002/0163934) dealing with extracting and 
analyzing communication sessions from network packet data. 

• Freedman (US Patent 7,301,910) pertaining to monitoring and analysis of 
signaling links. 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to MARIA L. SEKUL whose telephone number is (571)270- 
7636. The examiner can normally be reached on Monday - Friday 8:00-5:30 EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Lewis West can be reached on (571 ) 272-7859. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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